As explored in a previous article regarding the European Commission’s rejection of the draft Regulatory Technical Standards on ICT subcontracting under DORA (the “RTS”), the European Supervisory Authorities (“ESAs”) have now issued their formal opinion addressing the amendments proposed by the Commission.
In their opinion dated 7 March 2025, the ESAs acknowledge the Commission's concerns regarding Article 5 of the draft RTS, which had originally introduced monitoring requirements on ICT subcontracting chains. The Commission previously determined that these specific requirements exceeded the ESAs' mandate under Article 30(5) of DORA by imposing conditions not explicitly linked to the conditions for subcontracting. The Commission had particularly objected to Article 5 of the RTS, pinpointing that monitoring requirements related to ICT subcontracting chains exceeded the delegated authority granted to the ESAs and thus required removal to align with DORA's intended scope.
The ESAs have now formally endorsed the amendments suggested by the Commission, emphasising that these adjustments ensure alignment with the original mandate set forth by DORA. Additionally, they have also accepted minor editorial changes recommended by the Commission, describing these as non-substantive edits intended to improve clarity and readability.
The issuance of this opinion provides some much-needed clarity for financial entities and ICT service providers, dispelling some ambiguities and ultimately signalling a degree of progress towards finalising the RTS. The next step in the RTS’ process is that its text needs to be finalised by the Commission and the ESAs are encouraged the Commission to do so without delay.
Entities affected by DORA should now closely monitor developments with regard to the RTS and proceed in (re-)aligning their contractual frameworks and compliance strategies accordingly.
---
For more information and assistance with regards to DORA, please contact us at info@gtg.com.mt.
Author: J.J. Galea
We have extensively covered DORA in the past. Looking for more information? Continue reading on:
The Digital Operations Resilience Act
European Commission Rejects RTS on ICT Subcontracting under DORA
ESAs Release Second Set of Policy Products under DORA
Get Ready: DORA Impact Looms for ICT Service Providers